Event-by-event Simulation of Quantum Cryptography Protocols* 
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I. INTRODUCTION 

Cryptography is an artifice of exchanging information 
between two parties such that an unauthorized person 
cannot retrieve this information. To this end, the sender 
usually employs some key to encrypt the information to 
be transmitted, and the receiver applies a decryption al- 
gorithm to recover the original information. If the cryp- 
tographic system is secure, an eavesdropper can decipher 
the encrypted message if and only if the eavesdropper 
knows the key. Thus, the central problem of cryptog- 
raphy is to establish a powerful key. We may imagine 
that the more bits the key contains and the more com- 
plicated the key is, the more secure the process is. But, 
in practice, if the key is generated and transmitted in a 
conventional, electronic way, it may be possible to inter- 
cept the key. Then, the eavesdropper can make a copy of 
the exchanged information without changing it, such that 
the sender or receiver did not notice that the information 
has been intercepted. 

Quantum cryptography uses microscopic objects such 
as individual photons as information carriers 1 -. One of 
the characteristic features of such microscopic systems is 
that a measurement may change the information that the 
microscopic system carries. Therefore, if an eavesdropper 
attempts to make a measurement to determine a bit of 
the key, there is no guarantee that the information car- 
ried by the microscopic system is left unchanged. If the 
quantum cryptography protocol is designed properly, the 
presence of the eavesdropper is revealed by an increase 
of the error rate in the bits that are being transmitted 
from sender to receiver. 

Although there is no doubt that quantum theory is 
very successful in describing a vast number of experi- 
mental results, it is well-known that quantum theory has 
nothing to say about individual events that are being 
recorded in experiments^ 3 -. Yet, quantum cryptography 
uses individual events to transmit information, its secu- 
rity being guaranteed by axioms. Since the inception of 
quantum theory, the major fundamental problem of in- 
corporating in quantum theory the fact that we observe 
events only is often referred to as the quantum measure- 



ment paradox and has not yet found a solution within the 
realm of quantum theory^. Therefore, it seems worth- 
while the study the fundamental question what it is that 
makes quantum cryptography work: Logically speaking, 
it cannot be quantum mechanics because quantum me- 
chanics has nothing to say about individual events^* 3 -. 

In a number of recent papers^^^ ' 10 ^ 1 , we have 
demonstrated that locally-connected networks of process- 
ing units can simulate, event-by-event, the single-photon 
beam splitter, Mach-Zehnder interferometer experiments 
of Grangier et alM-, and Einstein-Podolsky-Rosen exper- 
iments with photon o 13 ' 14 . Furthermore, we have shown 
that this approach can be generalized to simulate univer- 
sal quantum computation^ by an event-by-event pro- 
cess^. Therefore, this suggests that at least in prin- 
ciple, it may be possible to simulate all wave interfer- 
ence phenomena and many-body quantum systems using 
particle-like processes only. In this paper, we extend this 
approach to quantum cryptography systems. 

The paper is structured as follows. In Sections HT1 and 
IIII1 we briefly review the two most popular protocols of 
quantum cryptography: the BB84 protoco l 16 i 17 ' 18 and 
Ekert 's protocol^. Although both protocols are closely 
related^, from the point of view of simulation algorithm, 
the latter is considerably more complicated than the for- 
mer, which is the main reason for discussing both of 
them. The simulation algorithms for the polarizer are 
presented in Section ITVl Simulation results for the BB84 
and the Ekert protocol, both with and without eaves- 
dropper, are given in Sections [V] and IVII Although our 
simulation method does not rely on any concept of quan- 
tum theory, it is nevertheless capable of simulating quan- 
tum cryptography protocols on the event-by-event level. 
Therefore, it may shine light on the question what is 
essential for quantum cryptography to work. In Sec- 
tion [VDj we discuss this issue. The results of this paper 
are summarized in Section IVIIl 
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II. BB84 PROTOCOL 

In 1989, an experimental prototype that imple- 
mented the quantum cryptography protocol BB84 1 - i 17 ' 18 , 
demonstrated that it is possible to transmit an encryp- 
tion key using the polarization state of single photons. 
In this section, we briefly review the idea behind this 
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TABLE I: Summary of the BB84 protocol. The first column shows the bit that Alice wants to encode and send to Bob. The 
second and third columns give the orientations of Alice's and Bob's polarizers, respectively. The fourth and fifth columns are 
the probabilities that Bob detects a photon in the output channel and 1 of his polarizer. The last column gives the bit that 
Bob obtains from his measurement. The question mark indicates that the probability that Bob makes the wrong guess is 50%. 
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protocol. 

The BB84 protocol employs the polarization state of 
photons as the information carrier. As each detection of 
a single photon yields one out of two definite answers for 
the polarization of the photon, these observations can be 
described by the quantum theory of a two-state system. 
The BB84 protocol uses two sets of non-orthogonal co- 
ordinate systems, which are the usual x-y (rectilinear) 
basis and the diagonal basis which is the rectilinear basis 
rotated by 45°. In the rectilinear basis, the photon can 
be either in the horizontal ( — >) or in the vertical (f ) po- 
larization state. In the diagonal linear basis, the photon 
can be either in the diagonal (/*) or in the anti-diagonal 
(\) polarization state. 

Let Alice and Bob be the two parties who want to ex- 
change a secret key. Alice generates and sends Bob a 
sequence of photons with polarization states that are se- 
lected randomly from the four possible directions: 0°( — > 
),45°(/ , ),90°(t) and 135°(\). The bits of Alice are en- 
coded from these directions in the following way: 0° and 
45° represent bit 0, 90° and 135° represent bit 1. When 
a photon arrives at Bob's observation station, Bob per- 
forms a measurement on this photon based on a randomly 
selected basis, either the rectilinear or the diagonal ba- 
sis. Bob encodes the outcome of his measurements in the 
same way as Alice does. If Bob chooses a basis which is 
consistent with Alice selection (for instance, Alice's sends 
a photon polarized in 0° or 90°, and Bob performs the 
measurement on the rectilinear basis), then it is assumed 
that Bob's bit is identical to that of Alice. Otherwise Bob 
will guess the wrong bit for about 50% of the detected 
photons. Table [T] lists the various possibilities that Al- 
ice and Bob may encounter during the exchange of data. 
It should be clear from this discussion that up to this 
point, it has been assumed that the detectors operate 
with 100% detection efficiency, that the coordinate sys- 
tems of Alice and Bob are perfectly aligned and so on, 
that is we assume that the experiment is perfect. 



After recording a collection of events, in the next step, 
Alice and Bob will sift the key from the original raw bits 
by communicating through a conventional classical chan- 
nel. For each photon that Bob has received, he tells Alice 
which basis he has selected but he does not tell her the 
result of the measurement. Then, for each photon, Al- 
ice announces to Bob whether he made a correct choice. 
Finally they discard all the bits for which Bob has made 
the wrong choice of basis. The bits that survive the sift- 
ing procedure constitute the key and be used to encrypt 
the data that they want to send to each other. 

An eavesdropper, conventionally called Eve, who at- 
tempts to intercept some photons during the key trans- 
mission process will cause some errors in the sifted key, 
and these errors can be detected by Alice and Bob 
through publicly comparing randomly selected subsets 
of their sifted key. If Eve performs the similar measure- 
ments as Bob on all photons sent by Alice, and then 
prepares and resents new photons according to her mea- 
surements, Alice and Bob will observe an error rate of 
about 25% and conclude that their communication chan- 
nel is not secure. 



III. EKERT'S PROTOCOL 

In 1991, Artur Ekert proposed another protocol based 
on entanglement states with security guaranteed by Bell 
inequalities— . The source can be any two-particle system 
with some property entangled. In the original proposal 
of the protocol, pairs of spin-i particles in a singlet state 
are used as the information carrier, but in the real experi- 
ment o 20 i 21 , polarization entangled photon pairs are most 
commonly used to implement this protocol. In Ref. 21 , 
the CHSH inequality (one of the many forms of a Bell 
inequality) is used to test of the security. In Ref^ an- 
other form of Bell inequality, the Wigner inequality 22 , 
provides a relative simple test of the security. In this 
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TABLE II: The quantum theoretical predictions for the single- and two particle probabilities of a system in the singlet state and 
in the product state. The upper part shows the probability of observing + on one side and the joined probability of observing 
+ on both sides. The lower part gives the expressions for the Wigner parameter S and the modified Wigner parameter S' . 
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section, we briefly review the main idea of this protocol. 

First, it is assumed that there is a source that emits 
pairs of photons, one photon traveling to Alice and the 
other photon traveling to Bob. It is assumed that the 
state of the whole system, that is the description of the 
observation of the polarization of many pairs, can be de- 
scribed by the singlet state 

\*) = ±={\H) A \V) B -\V) A \H) B ), (1) 

where H and V denote the horizontal and vertical (linear) 
polarization states. When a pair of photons A and B has 
been generated at the source, they are spatially separated 
and sent to Alice and Bob through free air or through 
some special optical fiber. Then Alice and Bob perform 
measurements on the polarization state of the received 
photon using a polarizing beamsplitter. Both Alice and 
Bob independently and randomly select between two po- 
larization orientations. Let us denote the two orienta- 
tions of Alice by (f>A 1 and 4>a 2 , an d those of Bob by <$>b x 
and <f> b 2 • The outcome for an individual measurement 
is represented by either +1 or — 1. Because of the as- 
sumed entanglement between the polarization of the two 
photons, if Alice and Bob select parallel but otherwise 
arbitrary orientations of their polarizer, the outcomes of 
these two measurements are expected to display perfect 
anticorrelation. Thus, anticorrelation between the two 
measurements with (f>A 1 = 4>Bi can be used to establish 
the key. 

When the two photons of a particular pair are mea- 
sured in two non-parallel orientations, the correlation be- 
tween them cannot be recognized as such. Then, we need 
a test to see if the correlation are those of a system in 
the singlet state. The Wigner inequality provides a con- 
venient tool to do this. We denote by P ++ {<f)A 1 , </>b 2 )i 
P++{4>a 2 ,4>b 1 ), and P++{<f>A 2 i 4>b 2 ) the probabilities to 
obtain +1 on both sides for these three pairs of different 
orientations of the polarizers. Under the assumptions 
discussed in Appendix [S] these three probabilities must 



obey Wigner inequality 

P++(4>A,l,4'B,2) + P++((t>A,2,4 l B.l)-P++((t>A,2 1 4>B,2) > 0. 

(2) 

In Appendix \K\ we give a simple proof of the Wigner 
inequality. For later use, it is expedient to define the 
Wigner parameter by 

S = P++(4>A,1,4>B,2) + P++(4>A,2, 4>B,l)-P++(4>A,2,<pB,2) 

(3) 

For the singlet state Eq. J]}, quantum theory predicts 
that 

P++{4>AA,(t>B,i) = isin 2 (0 A ,i - 4> B a). (4) 

Inserting Eq. |4]) into Eq. ([2]), it is easy to check (see later 
for examples) that for some a range of </>a,i, 4>b, 2, 4>A,2, 
and 4>b,2, we have S < 0. Hence the Wigner inequality 
Eq. ([2]) is violated by a quantum system in the singlet 
state. For a particular choice of orientations that is used 
to implement Ekert's protocol namely 4>aa = 4>b. i = 0, 
cf) A 2 = 30°, and <i> B .2 = -30°, we find that S = -1/8. 
Any attempt to tamper with the singlet state will change 
S from its minimum value —1/8 to a larger one. 

What happens to the observed data when photons are 
intercepted and resend? Is the Wiger inequality still pow- 
erful enough to reveal the insecurity of the whole system? 
It turns out that the assumption of perfect anticorrela- 
tion, essential for the derivation of Wigner inequality, 
may cause a security problem. To alleviate this problem, 
a modified Wigner inequality that does not rely on the 
assumption of perfect anticorrelation was introduced in 
Ref^. An experimental test of the power of the modi- 
fied Wigner inequality in the presence of eavesdropping is 
given in Ref^ : . A simple proof of this Modified Wigner 
inequality is given in Appendix |Bj Introducing the mod- 
ified Wigner parameter 5" by 

S' = P++((t>A,l, <t>Bfl) + P++((j>A,2, <f>B,l) 

+ P — (4>A,l, <t>B,l) - P++(<t>A,2, <t>B,2), (5) 

the modified Wigner inequality reads 

S' > 0. (6) 
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Compared to the original Wigner inequality, an extra 
term is added which contributes when both Alice and 
Bob choose the same orientation of their polarizers. This 
extra term significantly increases the possibility of de- 
tecting the presence of an eavesdropper. 

For the simulation of this protocol in the presence 
of eavesdropping, we assume that Eve performs the 
intercept-resend strategy. This implies that Eve detects 
the two photons using two polarizers with orientations 
ipA and tpB , respectively, and then uses the result of her 
measurement of the two photons to prepare a photon that 
she sends to Alice and another photon that she sends to 
Bob. According to quantum theory, the photons received 
by both Alice and Bob are described by the product state 

|*) = (cosip A \H)A + sinipA\V) A ) 

x(cosiPb\H) b - sm^B\V) B )- (7) 

The predictions of quantum theory for the product state 
and the singlet state are summarized in Table HT1 

In Table HT1 4>a and 4>b denote the orientations of Al- 
ice's and Bob's polarizer, respectively, P+((j) A ) represents 
the probability that Alice obtains +1 in her measure- 
ment, P+(</> B ) denotes the corresponding probability for 
Bob's measurement, and P++(<fi A , (j) B ) refers to the prob- 
ability that both Alice and Bob record a +1 result. In the 
last two rows of Table [XT] we list the results of quantum 
theory for the original and the modified Wigner parame- 
ter for the polarizer settings <$>a.i = 4>b.i = 0, 4>a,2 = —9, 
and 4>b,2 = S. For the singlet state, the additional term 
in the modified Wigner parameter is zero. Hence there is 
no difference between S and S' and both of them only de- 
pend on 9. However in the case of a product state, the ad- 
ditional term sm 2 tpA sin 2 i/jb that depends on the polar- 
ization states of the photons and is always non-negative, 
hence S' > S. Thus, if Alice and Bob expect to ob- 
serve the singlet state they should find S" = S = —1/8. 
However, if Eve is intercepting and sending photons in a 
product state, the modified Wigner inequality provides 
more power to disclose the existence of an eavesdropper 
because Eve's actions will cause S' to change from being 
negative to positive while S may remain negative (see the 
examples shown later). 



IV. EVENT-BASED SIMULATION OF A 
POLARIZER 

Both the practical realization of the BB84 and the Ek- 
ert protocol use the detection of the photon polariza- 
tion. Hence, the polarizer is an indispensable apparatus 
for both Alice and Bob to perform their measurements. 
Therefore, to set up an event-by-event computer simu- 
lation model for these quantum cryptography protocols, 
we first need to consider event-based simulation models 
for a polarizer. 

Some optically active materials such as calcite split 
an incoming beam of light into two spatially separated 



beams depending on the polarization property of the in- 
cident beam 2 ^. If the incident beam has polarization ip 
and the orientation of the polarizer is denoted by <fi, the 
intensities of the two output beams and 1 are given by 
Malus' law 

I = cos 2 (-0 - (f>), 

h = sin 2 (i/> - 4>). (8) 

The polarization of output beam is <f>, and the polar- 
ization of output beam 1 is <j) + 7r/2. The incident beam 
is said to be randomly polarized if Iq = I\ = 1/2. 

The simplest simulation model of a polarizer deter- 
mines the type (0 or 1) of the output by comparing a 
uniform pseudo-random number r with cos 2 (ip — (f)). If 
r < cos 2 — ct>) , the output is of type 0, otherwise it is of 
type 1. For each individual input photon, the outcome 
is pseudo-random, but if we repeat this process for suf- 
ficiently many events (and the pseudo-random number 
generator is of sufficient quality), the frequencies of ob- 
serving photons in output and 1 will agree with Malus' 
law. In the sequel, this model for the polarizer will be 
called the probabilistic polarizer (PP). 

As an alternative for the PP, we will also simulate 
both protocols using a deterministic model for the polar- 
ixei— — — . This model will be called the deterministic 
polarizer (DP). As the details of this model are not of 
importance for (the analysis of) the results presented in 
this paper, we refer the reader who is interested in this 
and other deterministic simulation models for quantum 
phenomena to Refs. 4 5 6 7 26. In this paper, we show 
that both the PP and DP models are capable of repro- 
ducing exactly all the results of quantum theory for both 
the BB84 and the Ekert protocol using an event-by-event 
based simulation algorithm. 



V. EVENT-BASED SIMULATION OF THE BB84 
PROTOCOL 

In this section, we present the results of an event-by- 
event simulation of the BB84 protocol using both PPs 
and DPs. We start with the original BB84 protocol and 
demonstrate that the sifted bits obtained by Alice and 
Bob are identical, as expected. Then, we simulate the 
effect of eavesdropping by Eve who uses the intercept- 
resend strategy and show that this introduces significant 
errors in the sifted key. Finally, we study the effect of 
misalignment of the settings of both Alice's and Bob's 
polarizers by computing the fidelity of the sifted key as 
a function of the misalignment angles. 

A. Simulation of the BB84 protocol in the absence 
of an eavesdropper 

Two polarizers are needed to simulate this protocol, 
one for Alice, and another one for Bob. Alice uses her 
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TABLE III: The first 100 bits of the sifted key of the BB84 protocol without eavesdropping. The upper part gives bits - 50, 
the lower part gives bits 51 - 100. As expected, the sifted key of Alice is identical to the one obtained by Bob. 
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TABLE IV: The first 100 bits of the sifted key of the BB84 protocol in the presence of eavesdropping. The upper part gives bits 
- 50, the lower part gives bits 51 - 100. The differences between Alices's and Bob's sifted key are emphasized by underlining 
the bits. The error rate is about 26%. 
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polarizer to encode the bits she wants to send by (ran- 
domly) selecting the polarization 0°( — >), 45°(/), 90°(T) 
or 135°(\). Thus, if Alice wants to encode a random 
sequence of bits, Alice's polarizer 0a chooses randomly 
from these four directions. In the simulation, we use 
uniform pseudo-random numbers to select the polariza- 
tions, implying that half of the photons leave the polar- 
izer through output channel while the others leave the 
polarizer through output channel 1. The photons leaving 
through channel 1 are discarded and all the other photons 
are sent to Bob. The orientation <pB of Bob's polarizer 
switches randomly between 0°( — >) and 45°(/ < ). These 
two directions define Bob's two measurement basis, the 
rectilinear or diagonal linear basis. 

As indicated in Table HI the probabilities to observe a 
photon in output channel and 1 are cos 2 (</>a — 4>b) and 
sin 2 (<J)a — 4>b), respectively. It is clear from Table fl] that 
the cases for which Bob has a definite outcome corre- 
spond to situation in which Bob selected an observation 
basis that is consistent with the choice made by Alice. 

In Table IIIII we show the first 100 bits of the sifted 
sequence, extracted from a simulation sequence of 10 5 
events. After passing through Alice's polarizer, the num- 
ber of the photons sent to Bob is 49920 (approximately 
1/2 of the total number of events), and the length of the 
sifted key is 25072 (approximately 1/4 of the total num- 
ber of events). From Table HTT1 we see that the first 100 
bits of the sifted key that Alice and Bob obtain are iden- 
tical, as expected. We have checked that the other bits 
in the sifted key are identical also (results not shown). 
Furthermore, the simulation results for the sifted key do 
not depend the choice of the simulation model (PP or 
DP) for the polarizer (results not shown). The fidelity 
F, defined as the ratio of the correct bits in the sifted 
key to the length of the sifted key is 100%. 



B. Simulation of the BB84 protocol in the presence 
of an eavesdropper 

The presence of Eve is built into the simulation al- 
gorithm by adding a polarizer and implementing the 
intercept-resend strategy. Thereby, we assume that Eve 
intercepts all the photons that Alice sends to Bob and 
that she is able to perform the measurements in the same 
rectilinear or diagonal linear basis as the ones used by 
Bob. It is easy to see that for this type of eavesdropping, 
the error rate in the sifted key should be about 25%. In 
Table ITVl we show the first 100 bits of the sifted sequence, 
extracted from a simulation sequence of 10 5 events. The 
number of the photons that Bob receives is 50074 (ap- 
proximately 1/2 of the total number of events), and the 
length of the sifted key is 25043 (approximately 1/4 of 
the total number of events). In this case, the fidelity is 
about 75.2%. As in the case without eavesdropper, the 
simulation results for the sifted key do not depend on 
the choice of the simulation model (PP or DP) for the 
polarizer (results not shown). 



C. Misalignment of the measurement basis 

In this section, we consider a situation in which there is 
a misalignment of the measurement basis of both parties. 

In real experiments, it is unlikely that, say the rec- 
tilinear basis used by Alice is perfectly aligned with the 
rectilinear basis used by Bob. Furthermore, in real exper- 
iments the polarization of the photons changes as they 
propagate through the medium because of interactions 
with the medium (air, fibers). Moreover, for some strate- 
gies, the results of eavesdropping can be viewed as a ro- 
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FIG. 1: The fidelity F of the sifted key as a function of mis- 
alignment Quit- Solid circles (green): Simulation data using 
the PP model. Open circles (red): Simulation data using the 
DP model. Dashed line (blue): Theoretical prediction given 
by Eq. ©. 



on concepts of quantum theory. This should not come 
as a surprise: As quantum theory does not describe in- 
dividual events (the quantum measurement paradox)^, 
there is no reason to expect that quantum theory has 
any bearing on quantum cryptography, other than that 
it describes the averages over many events. As this point 
of view is in conflict with popular statements that quan- 
tum cryptography requires a full quantum mechanical 
description^ or that quantum cryptography relies on the 
Heisenberg uncertainty relation, it is of interest to con- 
sider the question at which point concepts of quantum 
physics enter into our event-by-event simulation of the 
BB84 protocol. 

From the description of the simulation algorithm, it is 
clear that in order for the BB84 to be secure, it is essen- 
tial that the message and messenger have the following 
properties: 

1. A message can be one out of two pairs of possible 
items only. 



tation of Bob's measurement basis, making it more dif- 
ficult to distinguish between a real misalignment of the 
basis and the presence of an eavesdropper. Thus, it is 
important to study the effects of misalignments of the 
coordinate systems. 

In our simulations, we use the orientations of Alice's 
polarizer as reference and tilt Bob's basis by an angle 
Quit- Therefore Bob's basis changes to from 0° to 0° + 
Ouit and from 45° to 45° + 9 t ut- In Fig. [fl we show our 
simulation results for the fidelity as a function of Quit- 

Unlike in the two previous cases, the simulation re- 
sults for the sifted key depend on the choice of the sim- 
ulation model (PP or DP) for the polarizer. For the 
PP model, the simulation data (solid circles in Fig. [T|) 
is in good agreement with experimental result a 27 i 28 . For 
this model, we may compute the averaged fidelity by av- 
eraging (according to Malus' law) the probabilities for 
obtaining identical bits in the sifted keys. We find 

F PP = cos 2 Quit- (9) 

This function is shown as the dashed line in Fig. [1] 
demonstrating that there is excellent agreement between 
theory and simulation. The open circles in Fig. [1] are the 
simulation data as obtained with the DP model. Clearly, 
the sifted keys obtained by using the DP model are much 
more robust with respect to misalignments of the polar- 
izers than the ones obtained by using the PP model. On 
the other hand, the DP results do not agree with cur- 
rently available experimental result o 27 ' 28 , suggesting that 
the polarizers that are used in these experiments are not 
described by the DP model. 

D. Discussion 

Clearly, our simulation algorithm for the BB84 does 
not solve an equation of quantum theory nor does it rely 



2. The messenger tells the recipient which of the two 
pairs the item that the messenger carries belongs 
to, but the messenger cannot tell a recipient which 
item it is. 

3. The messenger can deliver the message only once 
and after delivering the message, the messenger 
self-destructs. 

It is not too difficult to build a macroscopic device with 
these properties (minor modifications to intelligent con- 
tainers used for transport of valuables and cash would 
do) . Imagine that Alice has a set of boxes (the messen- 
gers) with the following properties: 

1 . Once closed, the box explodes when it is being tam- 
pered with. The box is shielded such that when 
it detects penetrating radiation, it explodes, mak- 
ing it impossible to analyze its content without de- 
stroying the content. Note that for secure quantum 
cryptography, similar conditions apply to Alice's 
and Bob's station tooi. 

2. As long as the box is open, Alice can wire the elec- 
tronics inside the box such that the electronic cir- 
cuit encodes one of the four possibilities according 
to Table |TJ After wiring her bit, she closes the box 
and sends it to Bob. 

3. On the outside, the box has a button and a switch, 
the setting of which corresponds to Bob's choice 
of the orientation of his measurements basis (see 
Table [TJ> . Bob puts the switch in one of its two 
positions and then he presses the button. The elec- 
tronics inside the box, causes the box to explode 
immediately, after five seconds or after ten seconds, 
corresponding to the case where Bob detects a 0, 
?, or 1, respectively (see Table 
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It is not difficult to see that this classical, macroscopic 
device is no less vulnerable to eavesdroppers than the 
quantum cryptography system. Of course, the latter is 
much more user-friendly and less expensive to operate. 



VI. EVENT-BASED SIMULATION OF THE 
EKERT PROTOCOL 

Starting from the observation that coincidence in time 
is a key ingredient in experimental realizations of the 
EPR gedanken experiment, several computer simulation 
algorithms have been proposed that (1) satisfy Einstein's 
conditions of local causality and realism and (2) exactly 
reproduce the two-particle correlation that is character- 
istic for a quantum system in the singlet state d 10 ' 11 . 
These algorithms generate the data event-by-event, use 
integer arithmetic and elementary mathematics to ana- 
lyze the data, and do not rely on concepts of probability 
theory or quantum theory. 

In this Section, we use these algorithms to perform an 
even- by-event simulation of Ekert's quantum cryptogra- 
phy protocol. For the sake of brevity, we do not review 
all the details of the algorithms. The reader who is in- 
terested in these aspects should consult the original pa- 
pers&^ ' 10 i n . The rigorous, probabilistic treatment given 
in Appendix [Clproves that our classical simulation model 
reproduces the correlations that are characteristic for a 
quantum system in the singlet state. 



A. Simulation of the Ekert protocol in the absence 
of an eavesdropper 

A schematic diagram of the simulation procedure is 
shown in Fig. O In the simulation algorithm, the source 
generates pairs of particles (photons in the real exper- 
iment). Particle A and B travel to Alice and Bob, re- 
spectively. Each particle carries a two-dimensional unit 
vector given by 

S n ,i = (cosipn,siaipn), 

Sn,2 = (-sinV>n,cos^ n ). (10) 

where n labels the number of the event. The vectors 
S n> i and 5„,2 represent the polarizations tp n and ip n + J 
of the two photons that fly to Alice and Bob, respectively. 
The distribution of ip n is taken to be uniform over the 
interval [0, 2tt). Note that after projecting the vectors 
<SVi,i and S n 2 onto dichotomic variables, the latter satisfy 
the conditions for deriving the Wigner inequality (see 
Appendix [5} . 

When the particle arrives at Alice's (Bob's) station, la- 
beled by i = 1 (i = 2), a random number is used to select 
the polarizer that will be used to perform the polarization 
measurement on the photon. This measurement maps 
the angle ip n onto the variable x n ^ = x n i(ip n , = 
±1. Thus, the results of generating N of these events 



can be summarized by 

r nii = {x nti =±l,A n ,i = ±l\n=l,...,N}, (11) 

where A n ^ denotes which of the polarizers has been se- 
lected. It is clear that we have assumed that the value of 
x n ,i depends on the incoming polarization and the inter- 
nal orientation of the selected polarizer only. 

In any real experiment, one needs a criterion to decide 
whether two objects form a single two-particle system or 
whether they may be considered as two single-particle 
systems. EPR experiments are no exception to thi o 13 ' 14 . 
EPR experiments with photons use coincidence in time 
to identify a single pair of two photons. Note that time 
coincidences play an essential role in real quantum cryp- 
tography experiments 1 -. 

In practice, Alice and Bob add time tags to their detec- 
tion events in order to be able to count coincidences. As 
the optical components (polarizers) induce time delays, 
it is reasonable for a particle to experience a time delay 
when it passes through the detection system. To mimic 
this, we introduce the time delay into our simulation al- 
gorithm ^ 10 ' 11 . At each station, we generate a time tag 
that depends on the local settings only. Then, we com- 
pare the difference between the two time tags with a cer- 
tain time window W. If this difference is smaller than 
W, the detection events are considered to be coincident. 
Otherwise, they are discarded. 

We assume that the maximum time delay T n ^ for a 
particle passing through a polarizer depends only on the 
angle difference between the polarization of the incident 
particle and the internal orientation of the polarizer. For 
instance, on Alice's side, we set T n ^\ = T n ^i(ip n — 4>a,z)- 
The time tag t n> i itself is taken to be a pseudo-random 
number from the interval [0, T„ j^ i 9 ' 10 ' 11 . Summarizing, 
the simulation algorithm generates two data sets 

T„,i = {x n4 = ±l,A„ ;i = ±l,t n .i\n = 1, N}, (12) 

for i = 1 (Alice) and i = 2 (Bob). The structure of these 
data sets is identical to the data sets collected in EPR 
experiments with photon o 13 ' 14 . 

From Ref.— i 9 - ' 10 ! 11 , we know that the simulation model 
can reproduce all the results of quantum theory of a sys- 
tem of two 5=1/2 particles if we take T nl (9) — |sin 26*| d 
(note that we have chosen the maximum time delay as 
the unit of time). Here d is a free parameter, which we 
call the time-delay parameter. If d = 0, we have T„.i = 1, 
implying that the maximum time delay does not depend 
on the relative orientation. In this case, the time delay 
has no essential influence on the final results^ 9 - ' 10 ' 11 . In 
our simulation (and also in experiment^ 3 -) , we first fix 
the time-tag resolution, denoted by < r < 1. Then, in 
our simulations, the time window is defined by W = kr, 
where k is an integer. It is clear that r effectively deter- 
mines the resolution by which we can resolve differences 
in the angles. After generating N pairs and collecting the 
data Eq. (|12p. we count the coincidences and we obtain 
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FIG. 2: Schematic diagram of the event-by-event simulation of Ekert's quantum cryptography protocol, using the (modified) 
Wigner inequality as a guard against eavesdroppers. The source emits pairs of particles with orthogonal but random polariza- 
tion. The particles fly to Alice's and Bob's observation station, respectively. The rectangular boxes labeled by R direct the 
particles to one of the two polarizers, using a binary pseudo-random number. When the particle emerges from a polarizer it 
generates a +1 or —1 event, and a clock is used to attach a time tag to this event. After collecting all events, Alice and Bob 
use time coincidence to correlate their data and to extract the key. 



an estimate for the probability 



a 



++ 



C++ + C— + C+- + C-+ ' 



(13) 



where C X y = C X y (4>a,4>b) denotes the number of coin- 
cidences between the signal x = ±1 at station 1 and a 
signal y — ± 1 at station 2 for a fixed combination of <pA 
and 4>b and is given by 



c — 



N 



S x ,3 <Vr. ,(->(ll' 



ltn.l-tn.2l). (14) 



From Eq. (fl3|) we compute the Wigner parameter S ac- 
cording to Eq. ©. 

We first show simulation results obtained by using 
the DP model. In Fig. we plot the probability 
P ++ {4>aAb) for fixed <j> A = and < <f> B < 2tt. The 
values of the other parameters used in the simulation are 
k = 1, d = 2, r = 0.00025, and N = 10 s . The dashed line 
in Fig. [3] is the quantum theoretical prediction Eq. Q . 
From Fig. [31 we conclude that there is an excellent agree- 
ment between the simulation data and quantum theory. 



« 0.3 




FIG. 3: P++(<f>A, 4>b) as a function of \4>a — 4>b\- Solid circles 
(red): Simulation data obtained by using the DP model with 
d — 2. Dashed line (blue): Quantum theory (Eq. Q). 



For comparison, in Fig. 3] we present the simulation 
results for d — and d = 4. For d = 0, the two time 
tags that we generated are just two independent uniform 
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FIG. 4: P++(<f)A,4>B) as a function of \4>a — 4>b\- Open circles 
(red): Simulation data by using the DP model with d — 0. 
Solid circles (green): Simulation data obtained by using the 
DP model with d = 4. Dashed line (blue): Quantum theory 
(Eq. ©). 

pseudo-random numbers between and 1 and contain 
no information about the polarizations of the incident 
photons or the orientations of the polarizers. Therefore, 
because of the procedure to count coincidences, the size 
of the window can only influence the numbers of events 
we collect: W affects the statistical fluctuations only. 
As a check, we have taken a fairly large time window 
(W = lOOr) and found that in this case, the distribution 
P+-I_(</>A) <Pb) is very close to the distribution that we 
find if we accept all the events (no coincidence window). 
For d = 4, we see from Fig. [4] that the correlations are 
"stronger" than those of the quantum system 8 -* ^ 10 ' 11 . 

Next, we consider the Wigner parameter S for the fixed 
relation of the four orientations mentioned above: 4>a,i — 
= ¥>j 4>A:2 = <P — Q, 4>b,2 = + 0. Inserting these 
special values into Eq. ^ we get 

S(9) = sin 2 6 - i sin 2 29. (45) 

Since in this case, the Wigner parameter depends on 9 
only, it is sufficient to consider the case ip — 0. 

The simulation results are plotted in Fig(5] The val- 
ues of the parameters used in the simulation are k = 1, 
d = 2, r = 0.00025, and N = 10 8 . Again, we see an ex- 
cellent agreement between the simulation data and quan- 
tum theory. Furthermore, from Figf5]it is clear that the 
maximum violation of Wigner inequality is reached at 
9 = 30°. Therefore, in the Ekert protocol, the orienta- 
tions of both parties are chosen to be 4>a,i = 4>b, i = 0°, 
<i>A,2 = 30°, 4>b.2 = —30°. Then, the violation of the 
Wigner inequality signals the strong anti-correlation of 
the pairs and the Wigner parameter S can be used to 
quantify the security of the protocol. 

For completeness, we show in Fig. |S]the results for the 
Wigner parameter for the cases d = and d = 4. As 
discussed above, d = corresponds to the case for which 



FIG. 5: The Wigner parameter S as a function of 8. Solid 
circles (red): Simulation data obtained by using the DP model 
with d — 2. Dashed line (blue): Quantum theory (Eq. Q). 




FIG. 6: The Wigner parameter S as a function of 9. Open 
circles (red): Simulation data obtained by using the DP model 
with d — 0. Solid circles (green): Simulation data obtained 
by using the DP model with d — 4. Solid line (red): Quantum 
theory (Eq. ©). 



correlations are computed without taking the time-tag in- 
formation into account, showing "classical" correlations. 
For d = 4, the correlation is stronger than the one of 
the quantum system, hence the violation of the Wigner 
inequality can be larger. 

Having established that our simulation algorithm re- 
produces the results of quantum theory of a single sys- 
tem of two polarizations, we now use the algorithm to 
simulate Ekert 's quantum cryptography protocol. 

As discussed earlier, the anticorrelated bits are gener- 
ated using a parallel basis (that is, the basis selected by 
both parties is <j)A,i = 4>b,\ = 0°). After inverting all the 
bits from one of the two parties, we expect to obtain two 
identical sequences. The first 400 bits from a long sim- 
ulation are shown in Table |Vj In this simulation, which 
uses the DP model, we observe an almost perfect anticor- 
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TABLE V: The first 100 bits of the sifted key of Ekert's protocol without eavesdropping, as obtained by using the DP model. 
The upper part gives bits - 50, the lower part gives bits 51 - 100. In this case, there are no errors in this part of the sifted 
key (the error rate is very low (10 -5 )). 
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TABLE VI: The first 100 bits of the sifted key of the Ekert protocol without eavesdropping, as obtained by using the PP 
model. The upper part gives bits - 50, the lower part gives bits 51 - 100. The differences between Alices's and Bob's sifted 
key are emphasized by underlining the bits. There are only 2 errors in this part of the sequence. 
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relation of the two photons. Indeed, if 4>a,i = §b,\ = 0°, 
the relative error in the key is of the order of 10 -5 . 

Finally, we simulate this protocol by using the PP 
model. It is known that in order to reproduce the correct 
quantum correlations, we must take d = l 10 ' 11 . Except 
for the value of d, we take the same simulation parameters 
as in the DP-model simulations and repeat the calcula- 
tion. The simulation results are shown in Fig. [7j 

After inverting all the bits from one of the two par- 
ties, we obtain two sequences of bit strings, the first 100 
bits being shown in Table fVll The error rate in this sim- 
ulation is of the order of 10 -2 . That this error rate is 
larger than in the DP simulation is easy to understand: 
If we use the PP model, the outcome of each individual 
measurement is inherently (pseudo-) random instead of 
deterministic as in the case of the DP model. 



B. Simulation of the Ekert protocol in the presence 
of an eavesdropper 

In the previous subsection, we have demonstrated that 
by using the perfectly anticorrelated source, together 
with the time-tag model and a time window to count 
coincidences, we can reproduce the correlation that is 
characteristic for a quantum system in the singlet state. 
In this subsection, we simulate the situation in which an 
eavesdropper is present 

First, we consider the special case in which Eve uses 
two polarizers with fixed, perpendicular orientations: 
tpA = 45° and i\)b — 135°. We should imagine that 
Eve can put these polarizers on both sides of the source. 
Hence, she can manipulate the polarization that Alice 
and Bob will observe in their measurements. 
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FIG. 7: The Wigner parameter S as a function of 8. Solid 
circles (green): Simulation data obtained by using the PP 
model with d = 4. Open circles (red): Simulation data ob- 
tained by using the PP model with d = 0. Dashed line (blue): 
Quantum theoretical result for S (see Table [TTJ) ; Dashed line 
(black): Analytical results for S and d = (see Appendix \C\ . 



Our simulation model can easily deal with this compli- 
cation: We just put two PPs (or DPs) between the source 
and Alice and the source and Bob, respectively. We re- 
peat the simulations as in the case without an eavesdrop- 
per and plot the two Wigner parameters S and S' as a 
function of 9. 

In Fig. [SI we see two groups of curves with the same 
shape: The simulation result of 5" (blue solid dia- 
monds) and the quantum theoretical result of the mod- 
ified Wigner parameter (red solid line) agree very well. 
The simulation result of S (green solid triangles) and 
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FIG. 8: The fidelity F of the sifted key and the two Wigner 
parameters S and S' as a function of 9. Solid circles (red): 
Simulation data for F; Dashed line (blue): Quantum theoreti- 
cal result for F (F — 1/2); Solid diamonds (blue): Simulation 
data for S'; Solid line (red): Quantum theoretical result for 
S' (see Table Hi) : Solid triangles (green): Simulation data for 
S; Dotted line (black): Quantum theoretical result for S (see 
Table ED . 



FIG. 10: The fidelity F and the two Wigner parameter S and 



S' as a function of ipA for the case tpg 
see Fig. [8] 



90 u . For the legend, 
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FIG. 9: The fidelity F and the two Wigner parameter S and 
S' as a function of ipA for the case ipB = if) a + 90°. For the 
legend, see Fig. [8] 



the quantum theoretical result of the Wigner parameter 
(blue dashed line) are in excellent agreement too. Both 
the data for S and S' are larger than zero, signaling the 
presence of an eavesdropper. As S' > S, the modified 
Wigner parameter clearly is more powerful to disclose 
the eavesdropper. 

Also shown in Fig. [8] is the fidelity of the sifted key as 
a function of 9. The simulation data for F(9) lies on top 
of the theoretical expectation F(9) = 1/2. It is clear that 
the fidelity does not depend on the angle 9. In this case, 
the value of the fidelity is about 0.5 due to the choice of 
the orientations of Eve's polarizers. 

Next, we take 9 = 30° (the optimal values for Ekert's 



protocol without eavesdropper) to study the dependence 
of the fidelity on the settings of Eve's polarizers. We 
consider two different situations: The first one is that 
Eve's polarizers always have perpendicular orientations. 
The second one is that we fix one of Eve's polarizers at 
tpB = 90°, and change the other setting ipA gradually 
from 0° to 180°. 

The results for the first case are shown in Fig. [51 The 
upper curves show the dependence of the fidelity on the 
orientation of Eve's polarizer: The solid circles represent 
the simulation data and the dashed line is the theoreti- 
cal result according to Malus' law (F = 1 — 5 sin 2 2i(>a)- 
The data in the middle are the simulation results (solid 
blue diamonds) and the quantum prediction (red line) of 
the Wigner parameter S'. The bottom curves in Fig. [5] 
show the simulation data and the theoretical result for 
the Wigner parameter S. Recall that in order to detect 
the presence of an eavesdropper, we must have S > or 
S' > for all ipA- Clearly, there is excellent agreement 
between theory and simulation. 

The results for the second case are depicted in Fig. [TO] 
The legend is the same as in Fig. [8] Again, there is ex- 
cellent agreement between theory and simulation. From 
Fig. [TU1 it is clear that as S < for some range of an- 
gles, using the Wigner parameter S would not allow Alice 
and Bob to recognize the existence of the eavesdropper, 
whereas if they use S' they can. 



VII. SUMMARY 

We present a new approach to simulate quantum cryp- 
tography protocols using event-based processes. The 
main feature of this approach is that it simulates the 
transmission of the individual bits by an event-based pro- 
cess. The algorithm that generates the events does not 
solve any quantum mechanical equation, thereby circum- 
venting the fundamental problems arising from the quan- 
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turn measurement paradox. Our simulation data for the 
BB84 and the Ekert protocol are, in all respects, in ex- 
cellent agreement with the theoretical expectations. Ex- 
tending the simulation method to account for effects such 
as depolarization by the medium (fibers, air) and noise is 
left for future research. 
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APPENDIX A: WIGNER INEQUALITY 

We consider a two-particle system (particle A and B) 
and a pair of instruments that can measure a two- valued 
variable on each particle. The two possible values of the 
observed variable are taken to be ±1. Each instrument 
has a range of settings. For applications to quantum 
cryptography, it is sufficient to consider the special case 
for which particle A is detected using one of the two 
settings 4>a,i and 4>a, 2, and particle B is detected using 
the two settings 4>b.i — 9A,i and 4>b,2- Each setting 
corresponds to a particular orientation of the apparatus 
that measures the polarization. It is assumed that the 
two observed results for a pair of particles are always 
opposite if the two instruments have the same setting. 
The Wigner inequality 

P ++ ((/)AA,(f)B,2) + P++(<f)A,2,<f>B,l)-P++((f>A,2 > <l>B,2) ^ 0. 

(Al) 

is a convenient tool to characterize the correlation be- 
tween the results of the measurements on particles A and 
B. 

Proof: For any combination of settings, for example, 
4>a,i and 4*b,2, the frequency of obtaining +1 on both 
sides is given by 



'B.2J 



N ++{(j)A,l,4>B,2) 

N 



(A2) 



where N ++ {cf>A,ij 4>b.2) denotes the number of events for 
which both instruments yield +1 and N is the total num- 
ber of events. For a different combination of the settings, 
the value of N is assumed to be the same (= ideal exper- 
iment assumption). We now show that 

N++{4>A,l, <t>B,2) + N ++ ((t>A,2,<t>B,l) 

- N ++ (<t> A ,2,4>B,2) >0, (A3) 

holds under the conditions mentioned earlier. 

Let us denote by 4^a \ aim ^"1 the results recorded 
for the ith pair using the settings <Pa,i and 4>b,2 Then 
N++(<f>A,i,4>B,2) can be written as 



n++{4>a,\, 4> 



B,2 



N 

£ 

n=l 



6 (n) 

°AA 



} B,2 



(A4) 



If the settings of the two instruments are such that 
f'A.i = 4>b,i then we have 9 A1 — ~9bi an< ^ 



N++((f>A,i, 9b,i) = ^2 



N -, , An) 

AA x "I" VBA 



0. (A5) 



Hence, instead of proving Eq. (|A3|) . we can equally well 
prove that 

N ++{^A,l,4>B,2) + N ++{4>A,2,4>Ba) - N ++ {4> A ,2,4>B,2) 

- N + +(<I>aa,<Pba)>0. (A6) 
Substituting Eq. ([Mf into Eq. (M\i we obtain 

N 

£ [(i + $>xi + ^g) + (i + + 4:1) 



-(1 + <t>%){! + 4>Z) - (! + Ci)(! + Ci)] 

> 0. (A7) 

After simplification, we find 

N 

E^aI-&(^2-^)>0. (A8) 



g j, we find 



Making use of the assumption that VA 1 

that (4>a \ ~ 9a iWyb 2 — 9b l) ^ 0- Hence, inequality 
Eq. (|A8|) holds and so do inequalities Eqs. ([Mj) and (fATij) . 
In the proof of Eq. (|A3|) , it has been assumed that the 

,...,N}, 
.,N} do 



observations {</>^|n = 1, . . . , N}, {9 A2 \n 



{9 { b\\ 



l,...,N}, and 



(n) 



1. 



not depend on whether we record N++((f>A,i, 9b,2)i 
N ++ ((pA,2, 9B,i), or N ++ (4> A ,2, 9B,i)- ln a computer sim- 
ulation, it is a simple matter to satisfy this assumption 
because we have perfect control over the pseudo-random 
numbers that are used to generate the events but in real 
experiments, the validity of this assumption cannot be 
taken for granted. 
Having shown that 



">aa,9b.2 



f>A,2,<l>B,l) 
f>A,2, 9B,2) ^ 0) 
M 



and assuming that the observations {4> A \ \n = 1 



(A9) 
,N}, 



A, 2\ 
{n) 

B. 2 



.,N}, {4><gh n 



1,...,N}, and 



{9 

{4>b 2\ n = !>•••! are independent random variables, 
we may invoke the law of large numbers^ to argue that 
for N — > oo, F + +(9A,l,9B,2) -> P++(9AA,9B,2) with 
probabilty one. Under these assumptions, the Wigner 
inequality Eq. (jAip holds. 



APPENDIX B: MODIFIED WIGNER 
INEQUALITY 

The proof of the modified Wigner inequality 

P++(9A,U 9B,2) +P++(9A,2,9Ba) + P — (9A,l,9B,l) 
-P++(9A,2,9B,2)>0i (Bl) 
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is very similar to the proof of the original Wigner inequal- 
ity. The essential difference is that the modified Wigner 
inequality holds if we drop the assumption of perfect an- 
ticorrelation. 

Adopting the same strategy as in AppendixfA] we have 
to prove that 

N ++ (4>AS,4>B,2) +N ++ ((f)A,2, 4>B,l) + N {4>AS, 4>B,l) 

-N ++ {(j) A>2 ,<j) B>2 )^Q. (B2) 



Using Eq. 

N 



4|), we can rewrite Eq. (|B2[) as 



E 



[(i 

+(i-^ n i)(i 



4 n) 2 ) 



(i- 
(i 



> o. 



(B3) 



After simplification, we find 

N 



EP+^k^i-^^+^S^S+^S)] >o. (B4) 



n=l 

It is easy to see that 



& + ^bWa\+&>0, (B5) 



always holds. Hence, inequality Eq. (|B2|1 holds. Invoking 
the same arguments that were used to replace frequen- 
cies by probabilities in Appendix [Aj it then follows that 
inequality Eq. (|B1[) holds. 



APPENDIX C: PROBABILISTIC TREATMENT 

If we replace the deterministic sequence of pseudo- 
random numbers that we use in the computer simula- 
tions by the mathematical concept of logically indepen- 
dent random variables, as defined in the (Kolmogorov) 
theory of probabilitit y 29 ^ 30 , we can readily obtain an- 
alytical expressions for the expectation values that we 
compute with the simulation model. This then allows us 
to analyze the event-based simulation of Ekert's protocol 
analytically. In particular, we will prove that for both 
the deterministic model of the polarized beam splitter 
(DP) and the probabilistic model of the polarized beam 
splitter (PP), the event-by-event simulation reproduces 
exactly the two-particle probability Eq. (|13[) of quantum 
theory. 

We start by assuming that there exists a probabil- 
ity, denoted by P(x\, X2, ij., t2\a, 0), to observe the data 
{xi, ti} and {x2, t 2 } for fixed orientations {a, 0} on both 
observation stations. 



As a first step, let us express the probability for observing the data {x\, £2, ti, t 2 } as an integral over the mutually 
exclusive events £i,<S;2- According to the rules of probability theor y 29 i 30 , we have 



1 pill />27T 

P{xi,x 2l ti 1 t 2 \a 1 (3) = — J J P(xi,x 2 ,ti,t2\a,/3,£x,&)P((i,&\a,0)d(id&, 



(CI) 



where ^1,^2 denotes the two-dimensional unit vector representing the polarization. Starting from the exact represen- 
tation Eq. (jCip . we may now use the knowledge that in our simulation model (but not necessarily in experiment), 
for each event, the values of {xi,X2,t±,t2} are logically independent of each other and that the values of 
({ x 2, t 2 }) are also logically independent of and £2 (ot and £1)). Thus, we may write 



P(x 1 ,x 2 ,t 1 ,t 2 \a,0) 



^2 J J P(xi,^2,t2,a,(3,^^2)P(x2,t2\a,(3^i^2)P^i,a\a,f3)d^2 



1 

1 
1 

4^2 

1 

4^2 



2-k i-2-v: 



—r / / P{x 1 ,t 1 \a^ 1 )P(x 2 , * 2 |A6)P(£i,&|a,/?)d&d6 



P( Xl \a, ^)P(h\a, ^)P(x 2 \0, &)P{t 3 \0, &)P(Zi , 6 \a, 0)d^ 2 



P( Xl \a, k ^)P(x 2 \0, b)P(t 3 \0, &)P(Si, GOd&dfc, 



(C2) 



where, in the last step, we used the knowledge that in our simulation model, the values of £1 and £2 are logically 
independent of a or 0. Note that Eq. (|C2|) gives the exact probabilistic description of our simulation model. 

The mathematical structure of Eq. (|C2[) is the same as the one that is used in the derivation of Bell's results. 
Thus, if we would continue along the same line as in Bell's work the model defined by Eq. (|C2[) cannot produce 
the correlation of the singlet state. However, the real factual situation in the experiment is different: The events 
are selected using a time window W that the experimenters try to make as small as possible^. Accounting for the 
time window, that is multiplying Eq. (|C2[) by the step function (see Eq. ([14]) ) and integrating over all t\ and t 2 , the 
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expression for the probability for observing the event (£1,2:2) reads 

. ~ / 2 "/ 2T ^i|a,ei)p(^i/3,6)^(«,/3,Si,S2,^)F(ei,6)^ide2 

P(Xl,X2 \Ot,p) = = 

E Xl , X2 =±i So Jo P ^ \ a -> ^) p {^\P, &)w{a, /?, a, 6, W)P(i!, 6)deidSa 
= C Pfala, ^)P(x 2 \P, 6M«, P, 6 jg, WQP(6 , 6Kij6 
/ 2 " u;(a, /3, 6,6, ^)P(a, 6)^1^2 

where the weight function in our simulation is 



1 



w(a,f3,£ 1 ,&,W) = — dh dt 2 e(W-\tx-t 2 \). (C4) 
J1J2J0 Jo 

with Xi = To I sin2(a — £i)\ d and T 2 = To j sin2(/3 — £2)! > an d the time delays U are distributed uniformly over the 
interval [0, TJ. The weight function will be less than one unless W is larger than the range of {t\, t 2 ). The integrals 
in Eq. (|C4|) can be worked out analytically, yielding 

w(a,P,Z 1 ,b,W) = -±— [ T? + T 2 2 + 2(T 1 + T 2 )W+(W-T 1 )\W-T 1 \ + (W-T 2 )\W-T 2 \ 

i±l±2 

-(W -Ti + T 2 )\W - Tx + T 2 \ -(W + Ti- T 2 )\W + T X -T 2 \ ]. (C5) 

We now consider the specific case of the PP and the DP model, respectively. The PP reproduces Malus law for a 
single polarizer, that is the probability distributions P(xi|a,£i) and P(x 2 \/3,^ 2 ) can be written as 

l + xiCos2(a-£i) 
P(xi|a,Ci) = 



2 

p, ,0 t x l + x 2 cos2(/?-6) 

P(X2|P,S2) = g " ^ •* 

Let us now consider the case of Ekert's protocol and specialize to the case that the source emits particles with opposite 
polarization P(£i,&) = <K£i + 7r /2 — 6)-P(6) with P(£i) being a uniform distribution. If d = and < To, we have 
w(a,P,£ u &,W) = (2T - VF)VF/T 2 . Likewise, if W > T , w(a, f3,£ u &,W) = 1. Therefore, if W > T Q or d = 0, we 
have 

p, 1 m _ /o * .C PQeiK gQPfralfl 6)^(6, 6Ri^2 



— / l+Xicos2 (a-f (1-X2COS2 /3-£M 
2 — 2:12:2 cos 2(a — /3) 



(C7) 



and, more specifically, 



The corresponding expression of the Wigner parameter S reads 

^2-cos2fl + cos4fl (C9) 
8 

From Eqs. (|C7|) . (|C8[) and (|C9[) . it is clear that if we ignore the time-tag information, the two-particle probability 
takes the form of the hidden variable models considered by Bell^i, and the event-based model cannot reproduce the 
results of quantum theory. 

Next, we take into account the time-tag information and, to be able to obtain a closed-form expression, we focus 
on the limit W — > 0. Then, Eq. (|C5|) reduces to 

2W 

w (a, 0, fi,6,W-0) = ^-^ + (W 2 ). (CIO) 

max(Ti,T 2 ) 
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Inserting Eq. (ICTO)) and P(6,6) = + tt/2 - 6) into Eq. JC3]) we find 

St St P(^i|a,ei)^2|A6)^i ! 6)max(|sin2(a-a)|,|sin2(6- PW d d^ 2 



P(xi,x 2 \a,P) = 



f Jo 2 " P(6,6) max(| sin 2(6 - a)|, | sin 2(6 - /3)|)- d ^i^ 2 
1 J Q 27r (1 + xi cos 2 (a - - x 2 cos 2(/3 - 0) max(| sin 2(f - a)\, | sin 2(£ - P)\y d d£ 



4 



J 2 " max(| sin2(£ - a)\, | sin2(£ - 



(Cll) 



For d = A the integrals in Eq. (jClip can be worked out analytically and the result of this excercise reads 



yielding 



vi i m I - xix 2 cos2(a- 13) 

P(xi,x 2 \a,P) = , (C12) 

P++{a,/3) = isin 2 (a-/3), (C13) 

in exact agreement with the expression for a system of two S = 1/2 quantum objects in the singlet state. 

The analytical results for the deterministic model of the polarizing beam splitter can be derived in the same manner: 
We only have to change the specific expression for the probability distribution of a single polarizer. In the DP model, 
the values of x\ and x 2 are determined by the sign function. The corresponding probability distributions can be 
written as 

P(xi|a,£i) = e(x x cos2(a-a)), 

P(x 2 |A6) = 6(x 2 cos2(/3-6)). (C14) 

Now we study the same specific cases as we did earlier. First we consider the case for which W > To or d = 0. Then, 
we have 

p , , m St St jfeik CijPW 6)p(£i, 6Ri^ 2 

It St ni,b)db*b 

e (x x cos 2(a -O)© (-s 2 cos 2(0 - 0) C (C15) 



2tt 7 
yielding 

\<*-0\ 1 

7T 2 



P++(a,/3) = i 



(C16) 



Second, we consider the limit VF — > and find that for fixed (a,/3), the probability for observing the event (xi,x 2 ) is 
given by 

St St P(xi\a,Zi)P(x 2 \(3,&) max(| sin 2(6 - a)|, | sin 2(6 - /3)|)~ d P(6, 6)^6 



P(xi,x 2 \a,B) — - y 

It st max (i sin2 (^ - «)U sin 2 (& - /?)i)- d P(a, 6)^1^6 

J 27r 6 (X! cos2(a - 0) © (-x 2 cos2(/3 - 0) max(| sin2(£ - a)\, | sin2(£ - f3)\)- d d£ 

~ So ' max ( I sin 2 (i - «) I . I sin 2 (e - 0) l ) ' 



(C17) 



Writing 9 = j3 — a and putting d = 2, we find that the probability P++(a, /3) is given by 

1 j*^' 3 I sm2£|-<^ + St'iZli, I sin2« - 9)\-^ 



P++(a,/3) = 

1 



2 j;/^ 2 | sin2r^ + r/^% 2 I sin2(£ - 6)\-^ 



^sin 2 6>, (C18) 

in exact agreement with the expression for a system of two 5 = 1/2 quantum objects in the singlet state. 

I 
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